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CRIMINAL COMPLAINT 

I, the complainant in this case, state that the following is true to the best of my knowledge and belief. 
On or about the date of September 5, 2018, in the county of Los Angeles in the Central District of California, 
the defendants violated: 

Code Section Offense Description 

21 U.S.C. § 841(a)(1) Distribution of a Controlled Substance 

This criminal complaint is based on these facts: 

Please see attached affidavit. 
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AFFIDAVIT 


I, Tommy S. Fung, being duly sworn, declare and state as 
follows: 

I. PURPOSE OF AFFIDAVIT 

1. This affidavit is made in support of a criminal 
complaint and arrest warrant against CAMERON JAMES PETTIT 
("PETTIT"), for violations of 21 U.S.C. § 841(a)(1) 

I 

(distribution of a controlled substance). 

2. This affidavit is also made in support of an 
application for a warrant to search: 

a. the person of PETTIT, as described more fully in 
Attachment A-1; 

b. 1865 North Fuller Avenue, Apartment 206, Los 
Angeles, California 90046 ("PETTIT'S RESIDENCE"), as described 
more fully in Attachment A-2; 

c. a 2012 Mercedes Benz CLS 550 with California 
license plate M002W0 and vehicle identification niomber ("VIN") 
WDDLJ7DB8CA040491 registered to PETTIT at 386 Cliff Drive, 

Laguna Beach, California 92651 ("PETTIT'S CAR"), as described 
more fully in Attachment A-3; 

d. the person of MIA PASCAL JOHANSSON ("JOHANSSON"), 
as described more fully in Attachment A-4; 

e. 6300 Variel Avenue, Apartment 135, Woodland 
Hills, California 91367 ("JOHANSSON'S RESIDENCE") as described 
more fully in Attachment A-5; 

f. a 2013 white Mercedes Benz E350 with California 
license plate 8EQZ173 and VIN WDDHF5KB6DA765958 registered to 
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JOHANSSON at 15370 Weddington Street, Apartment 103, Sherman 
Oaks, California 91411 ("JOHANSSON'S CAR") as described more 
fully in Attachment A-6; and 

g. the person of KARLA AMADOR, also known as "Carla" 
and "Carolina Cortez" ("AMADOR"), as described more fully in 
Attachment A-7. 

3. . From the premises, vehicle, and person described in 
Attachments A-1 through A-3, the requested search warrants seek 
authorization to seize evidence, fruits, or instrumentalities of 
violations of 21 U.S.C. § 841(a)(1) (distribution of, and 
possession with intent to distribute, controlled substances) and 
21 U.S.C. § 846 (conspiracy to distribute controlled substances) 
(together, the "Subject Narcotics Offenses"), as described more 
fully in Attachment B-1. 

4. From the premises, vehicle, and persons described in 

I 

Attachments A-4 through A-7, the requested search warrants also 
\ 

seek authorization to seize evidence, fruits, or 
instrumentalities of violations of the Subject Narcotics 
Offenses, as well as 18 U.S.C. § 1952 (use of facilities in 
interstate commerce with intent to further unlawful activity, 
namely, prostitution in violation of California law) (together 
with the "Subject Narcotics Offenses," the "Subject Offenses"), 
as described more fully in Attachment B-2. Attachments A-1 
through A-7, B-1, and B-2 are incorporated herein by reference. 

5. The facts set forth in this affidavit are based upon 
my personal observations, my training and experience, and 
information obtained from various law enforcement personnel and 
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witnesses. This affidavit is intended to show merely that there 
is sufficient probable cause for the requested complaint, arrest 
warrant, and search warrants, and does not purport to set forth 
all of my knowledge of or investigation into this matter. 

Unless specifically indicated otherwise, all conversations and 
statements, including text messages, described in this affidavit 
are related in draft form and in substance and in part only. 

II. BACKGROUND OF AFFIANT 

6. I am a Special Agent ("SA") with the United States 
Drug Enforcement Administration ("DEA") and have been since May 
2012. I am currently assigned to the High Intensity Drug 
Trafficking Area ("HIDTA") division in the Los Angeles HIDTA 
Office. Additionally, I am a member of the HIDTA Fusion Task 
Force, which is tasked with, among other responsibilities, 
investigating suspected opioid-related overdose deaths.in Los 
Angeles County. 

7. As an SA, I have received 16 weeks of specialized 
training in Quantico, Virginia pertaining to drug trafficking, 
money laundering, undercover operations, and electronic and 
physical surveillance. Throughout my career as a federal agent, 
I have interviewed narcotics users, buyers, sellers, 
manufacturers, transporters, and informants, and I have 
discussed with them, and with other law enforcement officers, 
the methods drug traffickers use to safeguard their drugs and 
illicit proceeds and to avoid law enforcement detection. 
Additionally, I have conferred with other law enforcement 
officers regarding prostitution-related crimes, and how 
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telephones, computers, and the Internet are used to facilitate 
and conceal such crimes. 

III. SUMMARY OF PROBABIJ; CAUSE 

8. As discussed below, evidence shows that on September 
7, 2018, 26-year-old Malcolm- James McCormick died of a drug 
overdose — specifically, a mixed drug toxicity involving 
fentanyl, cocaine, and ethanol. In McCormick's home, law 
enforcement found evidence that McCormick snorted counterfeit 
oxycodone pills containing fentanyl shortly before his death. 

Two days before McCormick's death, in the early morning hours of 
September 5, 2019, PETTIT delivered counterfeit oxycodone pills 
that contained fentanyl — a dangerous synthetic opioid — 
cocaine and Xanax to McCormick. Hours after reports of 
McCormick's death became public, PETTIT told a friend that he 
would die in jail and asked another friend if he should post 
messages he had with McCormick. PETTIT resides at PETTIT'S 
RESIDENCE and drives PETTIT'S CAR. 

9. As discussed below, evidence also shows that in the 
early morning hours of September 5, 2019, a prostitute, AMADOR, 
delivered genuine oxycodone, hydrocodone, amphetamine, Xanax, 
and cocaine to McCormick. AMADOR had been sent to McCormick 
with drugs by her madam, JOHANSSON, after' McCormick contacted 
JOHANSSON for drugs because PETTIT did not immediately respond 
to McCormick's text messages. JOHANSSON is PETTIT'S associate 
and had worked in the past with PETTIT to sell drugs to 
McCormick. JOHANSSON resides at JOHANSSON'S RESIDENCE and 
drives JOHANSSON'S CAR. 
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IV. STATEMENT OF PROBABLE CAUSE 


A. McCormick Died of a Drug Overdose on September 7, 2018 

10. On the morning of September 7, 2018, McCormick was 
found dead in his residence in Studio City, California. I have 
reviewed the autopsy and toxicology report from the Los Angeles 
County Medical Examiner-Coroner, and learned that McCormick died 
of mixed drug toxicity involving fentanyl, cocaine, and ethanol. 

B. PETTIT and JOHANSSON Were Jointly Involved in 
Distributing Controlled Substances to McCormick 

11. Following McCormick's death, law enforcement recovered 
McCormick's cellular telephone from his residence.^ I have 
reviewed contents of McCormick's phone. 

12. McCormick's phone contained numerous text messages 
between McCormick and PETTIT, and between McCormick and 
JOHANSSON, in the months before McCormick's death.^ As described 
below, these text messages establish that JOHANSSON introduced 
PETTIT to McCormick and that JOHANSSON and PETTIT were jointly 
involved in distributing controlled substances to McCormick 


1 I believe that McCormick's phone belongs to McCormick 
based, in part, on the fact that it was recovered from 
McCormick's residence and because it contains numerous 
photographs of McCormick and messages addressed to McCormick. 

2 I believe that the text messages described in this 
affidavit were sent to and from telephone numbers belonging to 
PETTIT and JOHANSSON, in part, because subscriber information 
from Sprint and AT&T show that such text messages were sent to 
and from telephone numbers subscribed to by, respectively, 
"Cameron Pettit" and "Mia P. Johansson." In addition, those 
telephone numbers were saved in McCormick's phone under the 
names "Cam" and "Mia" ( i.e. , the first names of PETTIT and 
JOHANSSON), and the names "Cam," "Cameron," and "Mia" appear in 
the content of various text messages between McCormick and 
PETTIT and JOHANSSON. 
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a. On June 15, 2018, for example, JOHANSSON sent a 
group text message to both McCormick and PETTIT stating: "Cam 

[ i.e. , PETTIT]- I included my boy Mac^ in this message- take care 
of him." Following this text message, McCormick reguested 
controlled substances from PETTIT — and PETTIT agreed to 
provide McCormick with controlled substances — on various 
occasions between July and September^ 

b. At times, when PETTIT was not able to promptly 
deliver controlled substances, McCormick contacted JOHANSSON. 

On August 25, 2018, for example, McCormick texted PETTIT to ask 
if he could "cop" (which, based on my training and experience, I 
know to be a term that refers to purchasing controlled 
substances). After PETTIT responded that he was at work, 
McCormick initiated the following text message exchange with 


JOHANSSON: 


McCormick: 

JOHANSSON: 

McCormick: 

JOHANSSON: 


". . . are you close to the cribbo" 

"Huh? . . . I'm at my house why wats up hun" 
"cam [ i.e. , PETTIT] just at work another 30" 
"I'm out love" 


3 I know that McCormick was commonly known by the name "Mac 
Miller." 

4 On July 17, 2018, for example, McCormick texted PETTIT, 
"can I get some bars?" and PETTIT replied, "yea for sure, how 
many?" On July 28, McCormick texted PETTIT, "can I grab a ball 
10 blue guys and some bars," and PETTIT responded, "Yeah 
forsure." On August 17, 2018, McCormick asked, "you got a g and 
some blue guys?" and PETTIT responded "I got you." Based on my 
training and experience, and discussions with other agents, I 
have come to learn that Xanax is often referred to as "bars," 
quantities of cocaine are often referred to as a "G" or a 
"ball," and blue-colored oxycodone pills are often referred to 
as "blues." 
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JOHANSSON: 

"Do you want me to see if my other 
now or you waiting for Cameron" 

boy can come 

McCormick: 

"See what the deal with him is . . 

a quick g" 

. just heed 

JOHANSSON: 

"Ok." 


McCormick: 

"Muchos gracias . . . Anything?" 


JOHANSSON: 

"No hun sorry" 


McCormick: 

"All good I can wait on cam" 



Based on the content and context of these messages — including 
JOHANSSON'S statement that "I got none" and her subsequent'offer 
to "see if my other boy can come now" — I believe that 
McCormick contacted JOHANSSON to purchase controlled substances 
on this occasion. 

c. At times, McCormick also paid JOHANSSON for drugs 
PETTIT supplied. For example, in the early morning hours of 
September 3, 2018, PETTIT texted McCormick to settle McCormick's 
tab: "We still didn't take care of that 260 so now we're at 
340." In response, McCormick stated, "I got u bruh . . . 

Handling now . . . Just threw Mia [ i.e. , JOHANSSON] cash," to 

which PETTIT replied, "Thanks brotha." Notably, records from 
Venmo — a money transfer service — reflect that a Venmo user 
"@Malcolm-McCoimaick-l" sent $340 to Venmo user "@Mia-Johansson" 
on the morning of September 3, 2018. A note accompanying the 
payment states, "For cam." 
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13. Publicly accessible photographs from Instagram 

account "miamouseS," which I believe belongs to JOHANSSON,^ show 
that JOHANSSON and PETTIT have known each other since at least 
2017, and that their association continued after McCormick's 
death. For example, a photograph posted on April 4, 2017 
depicts PETTIT with his arm around JOHANSSON, accompanied by the 
caption "miamouseS . . . @chefcambam . . . good time with good 

friends." I am familiar with PETTIT's appearance based on my 
review of PETTIT's photograph with the California Department of 
Motor Vehicles. In addition, a photograph posted July 21, 2019 
— approximately six weeks ago — depicts PETTIT and JOHANSSON 
together, accompanied by the caption "miamouseS Good time like 
old times with the fam @lil.cambam."® 

C. Cominxinications Between McCormick and PETTIT, and 

between McC ormi ck and JOHANSSON, on September 4-5, 
201 -&- 

14. As described below, text, messages between McCormick 
and PETTIT, and between McCormick and JOHANSSON, beginning the 
night of September 4, 201S show that PETTIT supplied McCormick 
with drugs during the early rriorning hours of September 5, 201S, 
and that JOHANSSON arranged for a prostitute — AMADOR, using 


5 I believe the Instagram account "miamouseS" belongs to 
JOHANSSON, in part, because JOHANSSON appears in many of the 
photographs associated with the account. I am familiar with 
JOHANSSON's appearance based on my review of her photograph with 
the California Department of Motor Vehicles. In addition, 
JOHANSSON'S first name ("Mia") is included in the Instagram 
account name. 

® Instagram accounts containing a shortened version of 
PETTIT'S first name ( i.e. , "Cam") are also linked in the 
captions. 
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the alias "Carla""^ — to provide drugs to McCormick around the 
same time. 


1. McCormick Asks PETTIT for Controlled Substances 
15. Between approximately 11:07 p.m. and 11:58 p.m. on 
September 4, 2018, the following text message exchange occurred 
between McCormick and PETTIT: 

McCormick: "Yoooo" 


PETTIT: 

"Yoo what's up" 

McCormick: 

"did you hear back bout addy?" 

PETTIT: 

"Nah I couldn't find any" 

McCormick: 

"All good. You don't have lean do u?" 

McCormick: 

"percs?" 

PETTIT: 

"I got some dilaudid 2s but that's about it" 

PETTIT: 

"I could get yellows and blues though" 

McCormick: 

"blues as far as percs?" 

• PETTIT: 

"Yeah 30s" 

McCormick: 

"those are my shitttts man" 

McCormick: 

"When can u get em?" 

• PETTIT: 

"Probably in an hour or 2" 

PETTIT: 

"They are 30 ea" 

McCormick: 

"any chance I could get 10 of those 10 bars and 
a ball?" 

PETTIT: 

"Yeah forsure" 

PETTIT: 

"I will get back when I'm about to pick them 
up" 


Probable cause to believe that "Carla" is an alias for 
AMADOR is set forth in Part IV.G, infra . 
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McCormick: 

"fasho. Could you actually drop at the 
studio?" 

PETTIT: 

"Yeali where at?" 

McCormick: 

"I'm at Conway" 

McCormick: 

"Lemme send u the address. 

McCormick: 

"655 north St. Andrews place"® 

PETTIT: 

"Kk" 

McCormick: 

"is that far from you?" 

PETTIT: 

"Not too far I can make it" 

McCormick: 

"Okay word. Lmk when u on the way" 

PETTIT: 

"ok I will" 

McCormick: 

"What time u thinkin?" 

PETTIT: 

"Probably 1" 

McCormick: 

"that's for the blues too? Could u come thru 
with the other earlier?" 

PETTIT: 

"Yeah that's for all of it. I'm going to pick 
them up right now" 

McCormick: 

"Actually I can wait lol" 

McCormick: 

"Beautiful" 

PETTIT: 

"Ok sweet" 


The text messages above establish that PETTIT agreed to provide 
McCormick with the following controlled substances: (1) ten 
pills that PETTIT referred to as "blues" and "30s"; (2) a 

"ball"; and (3) ten "bars'." Based on .my training and 
experience, and discussions with other agents, I know that 

® Conway Recording Studios is a music studio located near 
the intersection of North Saint Andrews Place and Melrose Avenue 
in Los Angeles. 
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"blues" and "30s" often refer to blue-colored pills containing 
30 milligrams of oxycodone, a "ball" is a term for a quantity of 
cocaine, and "bars" refer to Xanax, a prescription anti-anxiety 
medication. Accordingly, I believe that, on the night of 
September 4, 2019, PETTIT agreed to supply McCormick with (1) 
ten 30 milligram oxycodone pills; (2) ten Xanax pills; and (3) 
cocaine.’ 

2. PETTIT Does Not Promptly Respond to McCormick's 

Follow-Up Text Messages 

16. Approximately one hour later — at 12:56 a.m. on the 


morning September 5, 2018 — McCormick texted PETTIT, "yo, yo." 
Approximately eight minutes later, McCormick texted PETTIT, 
"Wya?" (which I understand to be an abbreviation for "Where you 
at?"). Soon after, McCormick sent PETTIT a third text message, 
containing only a question mark. PETTIT did not respond to 
these messages for approximately one hour. 

3. McCormick Asks JOHANSSON for Controlled 
Substances 

17. At approximately 1:12 a.m. on September 5, 2018 — 
shortly after PETTIT failed to respond to McCormick's texts "yo, 
yo ... Wya?" — McCormick contacted JOHANSSON. The following 
text message exchange occurred between McCormick and JOHANSSON 
between approximately 1:12 a.m. to 1:47 a.m.: 

McCormick: "Cam is supposed to be pullin up and he ain't 

answering" 

JOHANSSON: "I don't know hun" 

McCormick: "Is there anybody else wit the shits?" 

JOHANSSON: "I can send some with a girl lol" 
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McCormick: 

"I need a few things" 

JOHANSSON: 

"I have everything lol" 

McCormick: 

"Snow bars and blue percs?" 

JOHANSSON: 

"I have it all" 

McCormick: 

"Do you have the lean too?" 

JOHANSSON: 

"No lean lol but Adderall too" 

JOHANSSON: 

"I have oxy" 

McCormick: 

"percs?" 

JOHANSSON: 

"I have norco" 

McCormick: 

"What mg? On oxy and norco?" 

JOHANSSON: 

"30 mg oxy and 10 mg norco" 

McCormick: 

"So the oxy are little?" 

JOHANSSON: 

"Yes little blue pill" 

McCormick: 

"Can I get 5 of those 5 bars and a g of snow?" 

JOHANSSON: 

"Yes" 

JOHANSSON: 

"30 mg oxy is $30 each and $5 each bar, $10 
each norco (they are 10 mg) ill give you the g 
for free if you book a girl" 

McCormick: 

"what about 2 gs?" 

JOHANSSON: 

"Deal lol" 

McCormick: 

"What girls is available?" 

JOHANSSON: 

"Carla [i.e., AMADOR] is ready" 

McCormick: 

"So what would my total be?" 

McCormick: 

"Send me a picture of the oxy tho" 

JOHANSSON: 

[Photograph of round blue pill imprinted with 
"El 8"] 

McCormick: 

"How long would all this take to arrive?" 
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JOHANSSON: 

"30 min" 

McCormick: 

"I'm at 655 St. Andrews" 

JOHANSSON: 

"With girl lol ?" 

McCormick: 

"Arrrghh" 

JOHANSSON: 

"Lol" 

McCormick: 

"What's the total of everything else" 

JOHANSSON: 

"5 oxy $150 ($30 each) 5 bars $25 ($5 each) 5 
norco $50 ($10 each) 10 Addy $100 ($10 each) 2 
g's (FREE) Girl $700. Total: $1025" 

McCormick: 

"send thruuuu" 

JOHANSSON: 

"S or N St. Andrews" 

McCormick: 

"North" 

JOHANSSON: 

"She's 31 min away" 


The text messages above establish that JOHANSSON agreed to 
provide McCormick with the following narcotics: (1) five "oxy"; 
(2) five "bars"; (3) ten "Addy"; (4) five "norco"; and (5) "2 
g's" of "snow." Based on my training and experience, I 
understand that "oxy" is an abbreviation for oxycodone, that 
"Addy" is an abbreviation for Adderall, a brand name 
prescription drug containing amphetamine, that Norco is a brand 
name prescription drug containing hydrocodone, and that "snow" 
is a commonly used name for cocaine. In addition, as noted 
above, "bars" refers to Xanax. Accordingly, I believe that 
JOHANSSON agreed to provide McCormick with: (1) five oxycodone 
pills; (2) five Xanax pills; (3) ten Adderall pills; (4) five 
Norco pills; and (5) two grams of cocaine. 
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4. 


PETTIT Delivers Drugs to McCormick 


18. At 2:02 a.iti. — approximately one hour after McCormick 

last tried contacting PETTIT, and approximately 15 minutes after 
the above-described text message exchange between McCormick and 
JOHANSSON ended — PETTIT sent the following text to McCormick: 
"Oh shit sorry I got sidetracked . . . Coming now." McCormick 

replied, "Fasho" (which I understand to be a form of the phrase 
"for sure"). 

19. At approximately 2:25 a.m., PETTIT texted McCormick, 
"Here," indicating that he had arrived at the studio referenced 
in McCormick's earlier text messages. McCormick responded by 
asking if PETTIT was "thru the gate," and PETTIT replied that he 
was "in front of the gate on St. Andrews." Accordingly, I 
believe that PETTIT ultimately delivered drugs to McCormick at 
the studio shortly after 2:25 a.m. on September 5, 2018.9 

5. AMADOR Delivers Drugs to McCormick, as Arranged 
by JOHANSSON 

20. Based on my review of McCormick's text messages, I 
also believe that the woman JOHANSSON referred to as "Carla" 
i.e. , AMADOR — visited McCormick at the studio during the early 
morning hours of September 5, 2018. Beginning at around 2:30 
a.m., for example, McCormick and JOHANSSON exchanged the 


9 Cell-site location data from Sprint indicate that PETTIT's 
telephone communicated with a cellular tower less than one mile 
from Conway Recording Studio between approximately 1:11 a.m. and 
1:20 a.m. on September 5, 2018. The records from Sprint contain 
no cell-site location data after 1:20 a.m. on the morning of 
September 5, 2018. Based on discussions with other agents and 
cellular service provider information, I know that not all 
transmissions over cellular telephones result in the creation of 
cell-site location data. 
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following text messages regarding how and when McCormick would 


pay for AMADOR's 

services and the drugs JOHANSSON agreed to 


supply: 


JOHANSSON: 

"How are you gonna send it hun cash app or 
Venmo?" 

JOHANSSON: 

"Are you gonna send it tonight or tomorrow 
hun?" 

McCormick: 

"I'll handle tomorrow" 

JOHANSSON: 

"Ok hun" 

JOHANSSON: 

"Did you want to extend an hr?" 

McCormick: 

"Yes pleaaase" 

JOHANSSON: 

"Ok cool :)" 

JOHANSSON: 

"Well just handle the $ tomorrow :)" 


Based on the content and context of these messages, I believe 
that JOHANSSON'S question, "Did you want to extend an hr?" 
referred to whether McCormick wanted to purchase an extra hour 
of prostitution services with AMADOR. 

21. Later on September 5, 2018, JOHANSSON sent McCormick a 
text message explaining the cost of AMADOR's prostitution 
services and .the drugs: 


JOHANSSON: 

"$325 pills. Normally it would have been $3500 
for Carla [i.e., AMADOR] but I'll take it from 
$700 an hr to $600 so only 3k and also I got 
you on the white :)) Total $3325. Hope you had 
a great night? Lmk how you want to square up 
hun XX" 


22. On the evening of September 5, 2018, JOHANSSON sent 
another series of text messages reiterating that McCormick owed 
$3,000 for "Carla's" services — "5 hrs at $600 each hr . . . 
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Instead of $700 . . . Since you did so many hrs" — plus $325 
for the drugs. McCormick acknowledged that a female had been 
present with him for several hours — "I just wanted an extra 
hour but I guess I never told her to leave . . . All the sudden 

in was 7am. I was just working and she was kickin it" — and 
ultimately agreed to pay JOHANSSON. JOHANSSON'S request for 
payment, and McCormick's willingness to pay, provides further 
reason to believe that "Carla" ( i.e. , AMADOR) visited him on 
September 5, 2018. 

23. Moreover, JOHANSSON'S text messages itemizing the cost 

of each controlled substance, and their total cost of "$325," 
further establishes that "Carla" ( i.e. , AMADOR) delivered to 
McCormick the type and quantity of drugs that JOHANSSON agreed 
to provide him (in addition to the free cocaine), specifically: 
(1) five oxycodone pills, at a price of $30 per pill, for a 
total price $150; (2) five Xanax pills, at a price of $5 per 

pill, for a total price $25; (3) tgn Adderall pills, at a price 

of $10 per pill, for a total price of $100; and (4) five Norco 
pills, at a price of $10 per pill, for a total price $50. 

D. Drugs Found at McCormick's Home Following McCormick's 
Death 

24. On September 7, 2018, after McCormick's death, law 
enforcement recovered a plastic bag from a coat hanging in 
McCormick's bathroom closet, which contained the following 
pills: 


I 
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a. six round blue pills imprinted with a "V" on one 
side and "48|12" on the other (the "Counterfeit Oxycodone Pills 
Containing Fentanyl") 

b. five round blue pills imprinted with "E|8" (the 
"Oxycodone"); 

c. ten round orange pills imprinted with "U30" (the 
"Amphetamine"); 

d. five white oval pills imprinted with "G037" (the 
"Hydrocodone"); and 

e. 14'white rectangular pills (some of which were 
broken) imprinted with "XANAX" (the "Xanax"). 

25. As described in the subparagraphs below, I believe 
that this bag contained all of the pills supplied by both PETTIT 
and JOHANSSON (through AMADOR) on September 5, 2018, less the 
pills that McCormick ingested before his death. Based on the 
chemical analyses of the pills conducted by a forensic 
laboratory and the text messages described above, I believe that 
PETTIT supplied McCormick with the Counterfeit Oxycodone Pills 
Containing Fentanyl and some of the Xanax, while JOHANSSON 
(through AMADOR) supplied McCormick with the Oxycodone, 
Amphetamine, Hydrocodone and the remainder of the Xanax. 

a. Counterfeit Oxycodone Pills Containing Fentanyl: 
The six round blue pills imprinted with a "V" on one side and 
"48112" on the other tested positive for fentanyl, a synthetic 
opioid significantly more powerful that heroin. I believe that 
PETTIT provided the Counterfeit Oxycodone Pills Containing 
Fentanyl to McCormick, in part, because McCormick asked PETTIT 


17 




to supply "percs," an abbreviation for Percocet, which is a 
prescription painkiller containing oxycodone; PETTIT described 
the Counterfeit Oxycodone Pills Containing Fentanyl as "blues" 
and the Counterfeit Oxycodone Pills Containing Fentanyl are blue 
in color; and PETTIT described the Counterfeit Oxycodone Pills 
Containing Fentanyl as "30s,and the Counterfeit Oxycodone 
Pills Containing Fentanyl resemble generic 30 milligram 
oxycodone pills. Specifically, the size, shape, color and "V" 
and "48 112" imprints resemble 30 mg oxycodone hydrochloride 
pills produced by Qualitest Pharmaceuticals, Inc. ("Qualitest"). 
(A side-by-side photographic comparison of one of the 
Counterfeit Oxycodone Pills Containing Fentanyl and a Qualitest 
30 milligram oxycodone pill is attached as Exhibit A.). 

b,. Oxycodone: The five round blue pills imprinted 
with "E|8" tested positive for oxycodone, a drug used to treat 
pain. I believe that JOHANSSON (through AMADOR) supplied the 
Oxycodone to McCormick, in part, because JOHANSSON told 
McCormick that she would provide him with "5 oxy"; "oxy" is an 
abbreviation for oxycodone; the blue pills imprinted with "E|8" 

tested positive for oxycodone; and exactly five pills - i.e. , 

the same number of "oxy" pills JOHANSSON agreed to supply — 
were in the bag. In addition, the oxycodone pills appear 
identical to the pill in a photograph that JOHANSSON texted 
McCormick immediately after McCormick requested that JOHANSSON 
"[s]end me a picture of the oxy." 

10 Based on my training and experience, I have come to learn 
that "30s" — in the context of prescription opiates — refers 
to milligrams of oxycodone. 
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c. An^hetamine: The ten round orange pills imprinted 
with "U30" tested positive for amphetamine, a drug used to treat 
hyperactivity disorders. I believe that JOHANSSON (through 
AMADOR) supplied the Amphetamine to McCormick, in part, because 
JOHANSSON told McCormick that she would provide him with "10 
Addy"; "Addy" is an abbreviation for Adderall; the active 
ingredient in Adderall is amphetamine; the round orange pills 
imprinted with "U30" tested positive for amphetamine; and ten 
pills -- i.e. , the same number of "Addy" pills JOHANSSON agreed 
to provide — were in the bag. 

d. Hydrocodone: The five white oval pills imprinted 
with "G037" tested positive for hydrocodone, a drug used to 
treat pain. I believe that JOHANSSON (through AMADOR) supplied 
the Hydrocodone to McCormick, in part, because JOHANSSON told 
McCormick that she would provide'him with "5 norco"; the active 
ingredient in Norco (a brand name prescription drug) is 
hydrocodone; the white oval pills imprinted with "G037" tested 
positive for hydrocodone; and five pills — i.6. , the same 
niomber of "norco" pills JOHANSSON agreed to provide — were in 
the bag. 

e. Xanax: The 14 white rectangular pills (some of 
which were broken) tested positive for alprazolam, a drug used 
to treat anxiety and panic disorders. I believe that both 
PETTIT and JOHANSSON (through AMADOR) provided Xanax to 
McCormick, in part, because PETTIT agreed to provide McCormick 
with "10 bars"; JOHANSSON told McCormick that she would provide 
him with "5 bars"; "bars" (as noted above) refers to Xanax; the 
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active ingredient in Xanax is alprazolam; the 14 white 
rectangular pills tested positive for alprazolam (and were 
imprinted with "XANAX"); the number of white rectangular pills 
in the bag was less than 15 ( i.e. , the aggregate number of Xanax 
pills PETTIT and JOHANSSON agreed to provide McCormick) but 
greater than ten (the amount PETTIT agreed to provide 
individually) and five (the amount JOHANSSON agreed to provide 
individually). 

E. McCormick Consximed the Counterfeit Oxycodone Pills 
Containing Fentanyl Before His Death 

26. Shortly after his death, law enforcement discovered a 
m.agazine in an open safe, in McCormick's bedroom with blue- 
colored powder and multiple indentations visible on its cover. 

A rolled piece of paper and a credit card-style gift card were 
nearby. Based on my training and experience, I know that users 
sometimes consume oxycodone pills by crushing them on a flat 
surface (frequently with a credit card) and snorting the 
resulting powder through a straw-like device (frequently rolled 
paper or rolled currency). The presence of powder and 
indentations on the magazine, as well as the rolled paper and 
gift card nearby, suggest that McCormick crushed and snorted one 
or more of the Counterfeit Oxycodone Pills Containing Fentanyl 
before his death. 

27. Moreover, the blue color of the powder indicates that 
the crushed pills were blue. As noted above, there were two 
types of blue-colored pills in the plastic bag: (1) the 
Oxycodone (imprinted with "E|8") that JOHANSSON supplied 
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(through AMADOR); and (2) the Counterfeit Oxycodone Pills 
Containing Fentanyl that PETTIT supplied. Notably, all ten 
Oxycodone pills that JOHANSSON supplied were still present in 
the bag. By contrast, only six of the ten Counterfeit Oxycodone 
Pills Containing Fentanyl that PETTIT agreed to provide 
McCormick were in the plastic bag. Accordingly, I believe that 
the blue powder came from the Counterfeit Oxycodone Pills 
Containing Fentanyl, not the Oxycodone pills. 

28. McCormick's post-mortem toxicology results further 
confirm that he consumed the Counterfeit Oxycodone Pills 
Containing Fentanyl shortly before his death. The toxicology 
report revealed that McCormick died from mixed drug toxicity 
involving fentanyl, cocaine, and ethanol. 

F. PETTIT'S September 8, 2018 Instagram Messages Reacting 
to McCormick's Death 

29. News reports of McCormick's death began circulating on 
the afternoon of September 7, 2018. On the evening of September 
7, 2018, PETTIT used his Instagram account "lil.cambam"ii to 
exchange the following direct messages with another Instagram 
user ("P.R."): 

PETTIT: "Hi." 

P.R.: "You good?" 

PETTIT: "I am not great." 

I believe that the Instagram account "lil.cambam" belongs 
to PETTIT, in part, because PETTIT appears in many of the 
photographs associated with the account. In addition, a 
shortened version of PETTIT's first name ("Cameron") is included 
in the Instagram account name, and the name "Cameron" appears 
next to the profile photograph (of PETTIT) on the top of the 
Instagram account. 
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P.R. : 

"Talk to me" 

PETTIT: 

"Most likely I will die in jail" 

P.R. : 

"I've been worried about you all day" 

P.R. : 

"Don't say that" 

PETTIT: 

"Yeah [frown face emoticon]" 

PETTIT: 

"Dangit" 

P.R. : 

"What do .you mean" 

P.R. : 

"You're just paranoid" 

PETTIT: 

"Nothing has happened yet" 

PETTIT: 

"But it might" 

P.R. : 

"Yeah, don't think negatively, ok" 

PETTIT: . 

"And I'm nervy" 

P.R. : 

"Babe idk try not to stress I feel like it's 
going to be ok" 

P.R. : 

"It's not your fault?" 

PETTIT: 

[frown face emoticon] 

PETTIT: 

"I'm gorina get off the grid" 

PETTIT: 

"Move to another country" 

PETTIT: 

"What should my name be" 

P.R. : 

"Are you really" 

P .R. : 

"Like do you honestly think it's that serious" 

P.R. : 

"Your name should be sweet baby dang daddy" 

P.R. : 

"Let's move to Stockholm" 

PETTIT: 

"Yes" 

PETTIT: 

"Ok maybe" 
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PETTTIT: 

"I don't know yet I will probably know 
tomprrow" 

P.R. : 

"Can you please keep me posted I'm worried 
about you" 

P.R. : 

"Cam" 

PETTIT: 

"Yeah" 

30. Within 

an hour of this direct message exchange, PETTIT 


messaged another Instagram user ("A.G.") to ask whether he 
should post on his Instagram account a photograph of a text 
message exchange between him and McCormick. PETTIT ultimately 
concluded that, "I think I should probably not post anything 
. . . just to be smart." 

31. The messages above — especially those reflecting 

PETTIT's belief that he might face sidostantial criminal exposure 
in the wake of McCormick's death ("I am not great . . . Most 

likely I will die in jail") — provide additional reason to 
believe that PETTIT distributed drugs to McCormick shortly 
before McCormick's death. 

G. JOHANSSON Arranged for a Prostitute, AMADOR, to 
Deliver Drugs to McCormick 

32. As explained above, JOHANSSON arranged for a 
prostitute — whom JOHANSSON referred to as "Carla" — to 
deliver controlled substances to McCormick on September 5, 2018. 
For the following reasons, I believe that "Carla" is an alias 
for AMADOR and, therefore, that AMADOR is the individual who 
delivered controlled substances to McCormick on September 5, 
2018. 
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1. JOHANSSON Arranged Prostitution Services for 

McCormick, Including by Sending "Carla" 

33. Text messages recovered from McCormick's phone reflect 
that in late August and early September 2018, JOHANSSON arranged 
prostitution services for McCormick on multiple occasions. On 
August 25, 2018, for example, JOHANSSON texted McCormick a 
photograph of a blond woman lying on a bed wearing lingerie, 
followed by a text message explaining that, "I can do $600 an hr 
for the blonde girl." McCormick responded that he would make a 
decision later: "Lemme check the temp of the evening and I'll 
hit u." 

34. Approximately two hours later, McCormick texted 
JOHANSSON and asked, "anybody available?" leading to the 
following text message exchange: 


JOHANSSON: 

"Yes blonde" 

McCormick: 

"Lemme see photo again?" 

McCormick: 

"Different one" 

JOHANSSON: 

[Photo of blonde woman in red lingerie] 

JOHANSSON: 

"You want different one ?" ' 

McCormick: 

"yes please" 

JOHANSSON: 

"Carla is available to be there at 4:15 

JOHANSSON: 

"But it's 800 an hr" 

McCormick: 

"Lemme see another photo of this one" 

JOHANSSON: 

[Photo of blond woman in lingerie] 

McCormick: 

"She available now" 

JOHANSSON: 

"Yes" 

McCormick: 

"Send her overrrr" 
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2 . 


JOHANSSON Texted McCormick a Photograph of 

"Carla" on August 29, 2018 


35. Four days later — on August 29, 2018 — the following 
exchange occurred between JOHANSSON and McCormick 


McCormick: 

"Yooo" 

JOHANSSON: 

"What's up hun" 

McCormick 

"anybody around?" 

JOHANSSON: 

"Yeah Carla and Gia" 

McCormick: 

"Gia cheaper right?" 

JOHANSSON: 

"Yup lol Gia is $600 an hr and Carla is $800" 

McCormick: 

"Yeah can u send Gia over" 

JOHANSSON: 

"Sure how many hrs ?" 

McCormick: 

"wait..," 

McCormick: 

"Lemme look at both real quick" 

JOHANSSON: 

"Do you need to resend pic" 

McCormick: 

"Can you resend Carla" 

JOHANSSON: 

[Photograph of "Carla"] 

McCormick: 

"Can you send Carla?" 

JOHANSSON: 

"Sure / how long ?" 

McCormick: 

"let's start with 2" 


36. The photograph of "Carla" that JOHANSSON sent to 
McCormick depicts a woman wearing lingerie with her breast 
exposed. The woman has distinctive tattoos, including tattoos 
on her right arm of a skull with tentacles and another skull 
wrapped in flowers (together, the "skull tattoos"). As 
discussed below, this photograph depicts AMADOR. 
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3. 


"Carla" Visited McCormick on September 5, 2019 


37. As noted above, there is probable cause to believe 
that "Carla" visited McCormick in the early morning hours of 
September 5, 2018, shortly after the following text message 
exchange between McCormick and JOHANSSON occurred: 


McCormick: 

"Cam is supposed to be pullin up and he ain't 
answering" 

JOHANSSON: 

"I don't know hun" 

McCormick: 

"Is there anybody else wit the shits?" 

JOHANSSON: 

"I can send some with a girl lol" 

McCormick: 

"What girls is available?" 

JOHANSSON: 

"Carla is ready" 


McCormick: 

"send thruuuu" 


38. Moreover, as described above, on the afternoon of 
September 5, 2018, JOHANSSON sent McCormick a text message 
explaining the cost of Carla's services: "Normally it would have 
been $.3500 for Carla but I'll take it from $700 an hr to $600 an 
hour." JOHANSSON'S request for payment for Carla's services — 
and McCormick's subsequent agreement to pay — confirms that 
Carla visited McCormick on September 5, 2018. 
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4. KARLA AMADOR Is the True Identity of "Carla" (Who 

Is Also Known as "Carolina Cortez") 

39. Based on my review of the "friends" list on 
JOHANSSON'S publicly accessible Venmo account,^2 j saw that the 
list includes an individual named "Carolina Cortez." A Google 
search for "Carolina Cortez" reveals that "Carolina Cortez" is 
an adult film actress. Tattoos visible on "Carolina Cortez" in 
pornographic videos — including the skull tattoos — appear 
identical to the tattoos visible in the photograph of "Carla" 
that JOHANSSON sent to McCormick on August 29, 2018. Similarly, 
the Twitter account @CarolinaCortezX (the "Cortez Twitter 
Account") contains nude and partially nude photographs of a 
woman with the skull tattoos. Accordingly, there is reason to 
believe that "Carla" and "Carolina Cortez" are the same person. 

40. I have viewed the version of the Cortez Twitter 
Account that was operative on or about July 3, 2019, and saw 
that it contained a link to Instagram account "karlaamadorx" 

(the "AMADOR Instagram Account"). The homepage of the AMADOR 
Instagram Account displays the name "Karla Amador (Carolina)" 
under a profile photograph of a woman closely resembling the 
woman in the photograph of "Carla," in which one of the skull 
tattoos is visible. Accordingly, I believe that "Carla," 
"Carolina Cortez" and "Karla Amador" are the same person. 


^2 I believe this Venmo account belongs to JOHANSSON, in 
part, because the name of the account is "@Mia-Johansson" and 
the telephone number linked to the account is the same telephone 
number used to send and receive the JOHANSSON text messages 
described in this affidavit. 
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41. Moreover, records related to AMADOR's August 2018 
arrest in Los Angeles for driving under the influence that I 
have reviewed indicate that AMADOR has skull tattoos on her arm 
Furthermore, I have viewed a booking photograph of AMADOR 
associated with that arrest and saw that it .resembles the 
individual in the photographs and videos of "Carla" and 
"Carolina Cortez" described above. 

42. Accordingly, I believe that "Carla" is an alias for 
AMADOR, and, therefore, as described above, that AMADOR 
delivered drugs to McCormick at JOHANSSON's direction on 
September 5, 2018. 

H. Investigation of the SUBJECT PREMISES and SUBJECT 
VEHICLES 

1., PETTIT'S RESIDENCE 

43. PETTIT'S RESIDENCE is located at 1865 North Fuller 
Avenue, Apartment 206, Los Angeles, California 90046, in the 
Westside Habitats Apartments. I believe that PETTIT presently 
resides at PETTIT'S RESIDENCE, in part, because a review of law 
enforcement databases reveals that PETTIT is associated with 
PETTIT'S RESIDENCE; law enforcement has reviewed a 2019 lease 
agreement for PETTIT'S RESIDENCE, which shows that PETTIT (and 
another individual) reside at PETTIT'S RESIDENCE; and Global 
Positioning System ("GPS") location monitoring of PETTIT'S CAR, 
which is registered to PETTIT (though at a different residence) 
shows that PETTIT'S CAR is frequently parked in the vicinity of 
the Westside Habitats Apartments, including as recently as 
August 9, 2019. 
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2 . 


PETTIT'S CAR 


44. PETTIT'S CAR is a 2012 Mercedes Benz CLS 550 with 
California license plate M002W0 and VIN WDDLJ7DB8CA040491. I 
believe that PETTIT'S CAR is used by PETTIT, in part, because it 
is registered to PETTIT. In addition, GPS location monitoring 
of PETTIT'S CAR shows that, on or about August 9, 2019, PETTIT'S 
CAR was driven from the vicinity of PETTIT'S RESIDENCE to the 
vicinity of the Sayers Club, which PETTIT lists as his place of 
work on his Facebook profile page.^^ Moreover, shortly after GPS 
location monitoring of PETTIT'S CAR established that it traveled 
from PETTIT'S RESIDENCE to the Sayers Club, law enforcement saw 
PETTIT inside the Sayers Club. Finally, GPS location monitoring 
of PETTIT'S CAR indicates that on or about July 28, July 30, 
August 3, and August 4, 2019, PETTIT'S CAR traveled to the 
vicinity of JOHANSSON'S RESIDENCE. 

3. JOHANSSON'S RESIDENCE 

45. JOHANSSON'S RESIDENCE is located at 6300 Variel 
Avenue, Apartment 135, Woodland Hills, CA 91367 within the Sofi 
Warner Center Apartments. JOHANSSON is believed to reside at 
JOHANSSON'S RESIDENCE (along with one adult and one child), in 
part, because a review of law enforcement databases reveals that 
JOHANSSON is associated with JOHANSSON'S RESIDENCE; subscriber 
information from AT&T for a cellular telephone subscribed to 


This Facebook account is named "ChefCamBam." I believe 
that the account belongs to PETTIT, in part, because the name 
"Cameron James" appears at the top of the profile homepage; and 
PETTIT'S full name, according to Department of Motor Vehicle 
records, is "Cameron James Pettit." In addition, PETTIT is in 
many of the photos associated with this Facebook account. 
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"Mia P. Johansson" (to and from which the JOHANSSON text 
messages described above were sent) is registered to JOHANSSON'S 
RESIDENCE; and leasing records from the Sofi Warner Center 
Apartments reviewed by law enforcement report that JOHANSSON 
presently resides at JOHANSSON'S RESIDENCE. 

4. JOHANSSON'S CAR 

46. JOHANSSON'S CAR is a 2013 white Mercedes Benz E350 
with California license plate 8EQZ173 and VIN WDDHF5KB6DA765958. 
I believe that JOHANSSON'S CAR belongs to JOHANSSON, in part, 
because it is registered to JOHANSSON. In addition, on July 17, 
2019, agents saw JOHANSSON'S CAR in the parking structure of the 
Sofi Warner Center Apartments, the apartment complex containing 
JOHANSSON'S RESIDENCE. 

V. TRAINING AND EXPERIENCE ON DRUG OFFENSES 

47. Based on my training and experience and familiarity 
with investigations into drug trafficking conducted by other law 
enforcement agents, I know the following: 

a. Drug trafficking is a business that involves 
numerous co-conspirators, from lower-level dealers to higher- 
level suppliers, as well as associates to process, package, and 
deliver the drugs and launder the drug proceeds. Drug 
traffickers often travel by car, bus, train, or airplane, both 
domestically and to foreign countries, in connection with their 
illegal activities in order to meet with co-conspirators, 
conduct drug transactions, and transport drugs or drug proceeds. 

b. Drug traffickers often maintain books, receipts, 
notes, ledgers, bank records, and other records relating to the 
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manufacture, transportation, ordering, sale and distribution of 
illegal drugs. The aforementioned records are often maintained 
where drug traffickers have ready access to them, such as on 
their cell phones and other digital devices, and in their 
residences and vehicles. 

c. Communications between people buying and selling 
drugs take place by telephone calls and. messages, such as e- 
mail, text messages, and social media messaging applications, 
sent to and from cell phones and other digital devices. This 
includes sending photos or videos of the drugs between the 
seller and the buyer, the negotiation of price, and discussion 
of whether or not participants will bring weapons to a deal. In 
addition, it is common for people engaged in drug trafficking to 
have photos and videos on their cell phones of drugs they or 
others working with them possess, as they frequently send these 
photos to each other and others to boast about the drugs or 
facilitate drug sales. 

d. Drug traffickers often keep the names, addresses, 
and telephone numbers of their drug trafficking associates on 
their digital devices and in their residence. Drug traffickers 
often keep records of meetings with associates, customers, and 
suppliers on their digital devices and in their residence and 
vehicles, including in the form of calendar entries and location 
data. 

e. Drug traffickers often use vehicles to transport 
their narcotics and may keep stashes of narcotics in their 
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vehicles in the event of an unexpected opportunity to sell 
narcotics arises. 

f. Drug traffickers often maintain on hand large 
amounts of United States currency in order to maintain and 
finance their ongoing drug trafficking businesses, which operate 
on a cash basis. Such currency is often stored in their 
residences and vehicles. Drug traffickers are often now using 
online or application-based payment options for drugs such as 
Venmo. Records of those transactions are often found in the 
drug traffickers' digital devices. 

g. Drug traffickers often keep drugs in places where 
they have ready access and control, such as at their residence 
or in safes. They also often keep other items related to their 
drug trafficking activities at their residence and in their 
vehicles, such as digital scales, packaging materials, and 
proceeds of drug trafficking. These items are often small 
enough to be easily hidden and thus may be kept at a drug 
trafficker's residence or in the drug trafficker's vehicles even 
if the drug trafficker lives with others or shares his cars with 
others who may be unaware of his criminal activity. 

h. It is common for drug traffickers and those who 
participate in prostitution-related crimes to own multiple 
phones of varying sophistication and cost as a method to 
diversify communications between various customers and 
suppliers. These phones-range from sophisticated smart phones 
using digital communications applications such as Blackberry 
Messenger, WhatsApp, and the like, to cheap, simple, and often 
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I 

prepaid flip phones, known colloquially as "drop phones," for 
actual voice communications. 

VI. TRAINING AND EXPERIENCE ON PROSTITUTION-RELATED OFFENSES 

48. Based on my training and experience and on my 
conversations with law enforcement officers who investigate 
prostitution-related crimes, I am aware of the following: 

a. Prostitution often involves, in addition to the 

! 

prostitute, one or more additional people who coordinate 
schedules, travel, advertising, and payment collection for th^t 
prostitute and other prostitutes. Prostitutes and those who 
manage them often maintain books, receipts, notes, ledgers, bank 

i 

j 

records, lists of customer information, location data, and other I 

j 

records relating the prostitution services provided. Such i 

records are often maintained in digital devices, in their } 

J 

vehicles, and in their residences. i 

b. Prostitution also involves communications between 
customers, the prostitute, and the prostitute's manager, 
coordinator, "pimp," or "madam." Such communications include 
telephone calls telephone calls and messages, such as e-mail, 
text messages, and social media messaging applications, sent to 
and from cell phones and other digital devices. Because of the 
nature of prostitution, often photographs and videos are sent 
and received. 

c. Prostitution is often a cash-business, so those 

I 

involved in prostitution often maintain on hand large amounts of 
cash representing payments received or to be made. Such cash is 
often stored in their residences and vehicles. In addition. 
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payment for prostitution services or to prostitutes are often 
now made through online or application-based payment options 
such as Venmo, evidence of which would be found in digital 
devices. 

d. It is also common for those who participate in 
prostitution-related crimes to own multiple phones of varying 
sophistication and cost as a method to diversify communications 
between various customers and those providing or arranging 
prostitution-services. 

VII. TRAINING AND EXPERIENCE ON DIGITAL DEVICES ^^ 

49. Based on my training, experience, and information from 
those involved in the forensic examination of digital devices, I 
know that the following electronic evidence, inter alia, is 
often retrievable from digital devices: 

a. Forensic methods may uncover electronic files or 
remnants of such files months or even years after the files have 
been downloaded, deleted, or viewed via the Internet. Normally, 
when a person deletes a file on a computer, the data contained 
in the file does not disappear; rather, the data remain on the 
hard drive until overwritten by new data, which may only occur 
after a long period of time. Similarly, files viewed on the 


As used herein, the term "digital device" includes any 
electronic system or device capable of storing or processing 
data in digital form, including central processing units; 
desktop, laptop, notebook, and tablet computers; personal 
digital assistants; wireless communication devices, such as 
paging devices, mobile telephones, and smart phones; digital 
cameras; gaming consoles; peripheral input/output devices, such 
as keyboards, printers, scanners, monitors, and drives; related 
communications devices, such as modems, routers, cables, and 
connections; storage media; and security devices. 
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Internet are often automatically downloaded into a temporary 
directory or cache that are only overwritten as they are 
replaced with more recently downloaded or viewed content and may 
also be recoverable months or years later. 

b. Digital devices often contain electronic evidence 
related to a crime, the device's user, or the existence of 
evidence in other locations, such as, how the device has been 
used, what it has been used for, who has used it, and who has 
been responsible for creating or maintaining records, documents, 
programs, applications, and'materials on the device. That 
evidence is often stored in logs and other artifacts that are 
not kept in places where the user stores files, and in places 
where the user may be unaware of them. For example, recoverable 
data can include evidence of deleted or edited files; recently 
used tasks and processes; online nicknames and passwords in the 
form of configuration data stored by browser, e-mail, and chat 
programs; attachment of other devices; times the device was in 
use; and file creation dates and sequence. 

c. The absence of data on a digital device may be 
evidence of how the device was used, what it was used for, and 
who used it. For example, showing the absence of certain 
software on a device may be necessary to rebut a claim that the 
device was being controlled remotely by such software. 

d. Digital device users can also attempt to conceal 
data by using encryption, steganography^ or by using misleading 
filenames and extensions. Digital devices may also contain 
"booby traps" that destroy or alter data if certain procedures 
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are not scrupulously followed. Law enforcement continuously 
develops and acquires new methods of decryption, even for 
devices or data that cannot currently be decrypted. 

50. Based on my training, experience, and information from 
those involved in the forensic examination of digital devices, I 
know that it is not always possible to search devices for data 
during a search of the premises for a number of reasons, 
including the following: 

a. Digital data are particularly vulnerable to 
inadvertent or intentional modification or destruction. Thus, 
often a controlled environment with specially trained personnel 
may be necessary to maintain the integrity of and to conduct a 
complete and accurate analysis of data on digital devices, which 
may take siibstantial time, particularly as to the categories of 
electronic evidence referenced above. Also, there are now so 
many types of digital devices and programs that it is difficult 
to bring to a search site all of the specialized manuals, 
equipment, and personnel that may be required. 

b. Digital devices capable of storing multiple 
gigabytes are now commonplace. As an example of the amount of 
data this equates to, one gigabyte can store close to 19,000 
average file size (300kb) Word documents, or 614 photos with an 
average size of 1.5MB. 

51. The search warrant requests authorization to use the 
biometric unlock features of a device, based on the following, 
which I know from my training, experience, and review of 
piablicly available materials: 
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a. Users may enable a biometric unlock function on 
some digital devices. To use this function, a user generally 
displays a physical feature, such as a fingerprint, face, or 
eye, and the device will automatically unlock if that physical 
feature matches one the user has stored on the device. To 
unlock a device enabled with a fingerprint unlock function, a 
user places one or more of the user's fingers on a device's 
fingerprint scanner for approximately one second. To unlock a 
device enabled with a facial, retina, or iris recognition 
function, the user holds the device in front of the user's face 
with the user's eyes open for approximately one second. 

b. In some circumstances, a biometric unlock 
function will not unlock a device even if enabled, such as when 
a device has been restarted or inactive, has not been unlocked 
for a certain period of time (often 48 hours or less), or after 
a certain tiumber of unsuccessful unlock attempts. Thus, the 
opportunity to use a biometric unlock function even on an 
enabled device may exist for only a short time. I do not know 
the passcodes of the devices likely to be found in the search. 

c. Thus, the warrant I am applying for would permit 
law enforcement personnel to, with respect to any device that 
appears to have a biometric sensor and falls within the scope of 
the warrant: (1) depress PETTIT'S, JOHANSSON'S, and AMADOR's 
thumb and/or fingers on the device(s); and (2) hold the 

device(s) in front of PETTIT's, JOHANSSON'S, and AMADOR'S face 
with his or her eyes open to activate the facial-, iris-, and/or 
retina-recognition feature. 
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52. Other than what has been described herein, to my 
knowledge, the United States has not attempted to obtain this 
data by other means. 

/// 

/// 
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VIII. 


CONCLUSION 


53. For the reasons described above, there is probable 
cause to believe that PETTIT violated 21 U.S.C. § 841(a)(1). 
There is also probable cause to believe that the items to be 
seized described in Attachment B-1 will be found in a' search of 
the premises, vehicle, and person described in Attachments A-1 
through A-3, and that the items to be seized described in 
Attachment B-2 will be found in a search of the premises, 
vehicle, and persons described in Attachments A-4 through A-1. 



Tommy S. Fung 
DEA Special Agent 


Subscribed to and sworn before me 
this ^o^ ay of August, 2019. 


ALKASAGAR 


HONORABLE ALKA SAGAR 

UNITED STATES MAGISTRATE JUDGE 
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